Vulnerability-Lookup

RHSA-2026:82703

Vulnerability from csaf_redhat - Published: 2026-10-14 03:09 - Updated: 2026-10-17 03:51

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Moderate

Notes

Topic: An update for Red Hat Hardened Images RPMs is now available.

Details: This update includes the following RPMs: rabbitmq-server4.3: * rabbitmq-server4.3-4.3.6-1.1.hum1 (aarch64, s390x, x86_64) * rabbitmq-server4.3-4.3.6-1.1.hum1.src (src)

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-67414

A flaw was found in rabbitmq-server. This vulnerability allows an authenticated remote attacker to cause a Denial of Service (DoS) by exhausting broker memory. When processing Advanced Message Queuing Protocol (AMQP) messages, the parser fails to limit the aggregate number of array elements across an incoming frame, causing small requests to expand into disproportionately large memory allocations. By sending repeated crafted frames, an attacker can trigger system-wide memory alarms, block legitimate message publishing, and disrupt broker availability.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@aarch64	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@s390x	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@src	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2026-67416

A flaw was found in rabbitmq-server, where the Advanced Message Queuing Protocol (AMQP) parser fails to validate the length of message body descriptors. An authenticated remote attacker with write permissions can exploit this vulnerability by publishing a crafted message with an unrecognized descriptor sharing a valid prefix. RabbitMQ misclassifies and stores the payload, causing downstream message consumer applications or cross-protocol conversion processes to crash during message decoding, resulting in a Denial of Service (DoS).

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE-1025 - Comparison Using Wrong Factors

Affected products

Fixed 4 products, the same list as for CVE-2026-67414

Threats

Impact Moderate

CVE-2026-67418

A flaw was found in rabbitmq-server. An authenticated user with message publishing permissions can transmit a specially crafted Message Queuing Telemetry Transport (MQTT) message containing an invalid property. When the broker forwards this message, an unhandled exception terminates the recipient's connection, leading to a targeted Denial of Service (DoS) for affected subscribers.

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE-248 - Uncaught Exception

Affected products

Fixed 4 products, the same list as for CVE-2026-67414

Threats

Impact Moderate

References

32 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:82703	self
https://images.redhat.com/	external
https://access.redhat.com/security/cve/CVE-2026-67418	external
https://access.redhat.com/security/updates/classi…	external
https://access.redhat.com/security/cve/CVE-2026-67416	external
https://access.redhat.com/security/cve/CVE-2026-67414	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-67414	self
https://bugzilla.redhat.com/show_bug.cgi?id=2552665	external
https://www.cve.org/CVERecord?id=CVE-2026-67414	external
https://nvd.nist.gov/vuln/detail/CVE-2026-67414	external
https://github.com/rabbitmq/rabbitmq-server/commi…	external
https://github.com/rabbitmq/rabbitmq-server/relea…	external
https://github.com/rabbitmq/rabbitmq-server/secur…	external
https://access.redhat.com/security/cve/CVE-2026-67416	self
https://bugzilla.redhat.com/show_bug.cgi?id=2552574	external
https://www.cve.org/CVERecord?id=CVE-2026-67416	external
https://nvd.nist.gov/vuln/detail/CVE-2026-67416	external
https://github.com/rabbitmq/rabbitmq-server/commi…	external
https://github.com/rabbitmq/rabbitmq-server/commi…	external
https://github.com/rabbitmq/rabbitmq-server/pull/17017	external
https://github.com/rabbitmq/rabbitmq-server/pull/17287	external
https://github.com/rabbitmq/rabbitmq-server/secur…	external
https://access.redhat.com/security/cve/CVE-2026-67418	self
https://bugzilla.redhat.com/show_bug.cgi?id=2552635	external
https://www.cve.org/CVERecord?id=CVE-2026-67418	external
https://nvd.nist.gov/vuln/detail/CVE-2026-67418	external
https://github.com/rabbitmq/rabbitmq-server/commi…	external
https://github.com/rabbitmq/rabbitmq-server/commi…	external
https://github.com/rabbitmq/rabbitmq-server/pull/17035	external
https://github.com/rabbitmq/rabbitmq-server/relea…	external
https://github.com/rabbitmq/rabbitmq-server/secur…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nrabbitmq-server4.3:\n  * rabbitmq-server4.3-4.3.6-1.1.hum1 (aarch64, s390x, x86_64)\n  * rabbitmq-server4.3-4.3.6-1.1.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:82703",
        "url": "https://access.redhat.com/errata/RHSA-2026:82703"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67418",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67418"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67416",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67416"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67414",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67414"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82703.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-10-17T03:51:52+00:00",
      "generator": {
        "date": "2026-10-17T03:51:52+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.2"
        }
      },
      "id": "RHSA-2026:82703",
      "initial_release_date": "2026-10-14T03:09:05+00:00",
      "revision_history": [
        {
          "date": "2026-10-14T03:09:05+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-15T13:52:28+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-17T03:51:52+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rabbitmq-server4.3-0:4.3.6-1.1.hum1@aarch64",
                "product": {
                  "name": "rabbitmq-server4.3-0:4.3.6-1.1.hum1@aarch64",
                  "product_id": "rabbitmq-server4.3-0:4.3.6-1.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rabbitmq-server4.3@4.3.6-1.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rabbitmq-server4.3-0:4.3.6-1.1.hum1@s390x",
                "product": {
                  "name": "rabbitmq-server4.3-0:4.3.6-1.1.hum1@s390x",
                  "product_id": "rabbitmq-server4.3-0:4.3.6-1.1.hum1@s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rabbitmq-server4.3@4.3.6-1.1.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rabbitmq-server4.3-0:4.3.6-1.1.hum1@src",
                "product": {
                  "name": "rabbitmq-server4.3-0:4.3.6-1.1.hum1@src",
                  "product_id": "rabbitmq-server4.3-0:4.3.6-1.1.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rabbitmq-server4.3@4.3.6-1.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rabbitmq-server4.3-0:4.3.6-1.1.hum1@x86_64",
                "product": {
                  "name": "rabbitmq-server4.3-0:4.3.6-1.1.hum1@x86_64",
                  "product_id": "rabbitmq-server4.3-0:4.3.6-1.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rabbitmq-server4.3@4.3.6-1.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rabbitmq-server4.3-0:4.3.6-1.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@aarch64"
        },
        "product_reference": "rabbitmq-server4.3-0:4.3.6-1.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rabbitmq-server4.3-0:4.3.6-1.1.hum1@s390x as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@s390x"
        },
        "product_reference": "rabbitmq-server4.3-0:4.3.6-1.1.hum1@s390x",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rabbitmq-server4.3-0:4.3.6-1.1.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@src"
        },
        "product_reference": "rabbitmq-server4.3-0:4.3.6-1.1.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rabbitmq-server4.3-0:4.3.6-1.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@x86_64"
        },
        "product_reference": "rabbitmq-server4.3-0:4.3.6-1.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-67414",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-14T17:33:22.610511+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2552665"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in rabbitmq-server. This vulnerability allows an authenticated remote attacker to cause a Denial of Service (DoS) by exhausting broker memory. When processing Advanced Message Queuing Protocol (AMQP) messages, the parser fails to limit the aggregate number of array elements across an incoming frame, causing small requests to expand into disproportionately large memory allocations. By sending repeated crafted frames, an attacker can trigger system-wide memory alarms, block legitimate message publishing, and disrupt broker availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rabbitmq-server: rabbitmq-server: Denial of Service via memory exhaustion in AMQP parser",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@aarch64",
          "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@s390x",
          "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@src",
          "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67414"
        },
        {
          "category": "external",
          "summary": "RHBZ#2552665",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552665"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67414",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67414"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67414",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67414"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/commit/3f0f67dfb7c4390e3cbfa25ab3ee19dcb0845bd4",
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/3f0f67dfb7c4390e3cbfa25ab3ee19dcb0845bd4"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.4",
          "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.4"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w6mq-4qpx-v7mh",
          "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w6mq-4qpx-v7mh"
        }
      ],
      "release_date": "2026-10-14T16:04:07.449000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-14T03:09:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@aarch64",
            "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@s390x",
            "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@src",
            "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:82703"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@aarch64",
            "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@s390x",
            "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@src",
            "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rabbitmq-server: rabbitmq-server: Denial of Service via memory exhaustion in AMQP parser"
    },
    {
      "cve": "CVE-2026-67416",
      "cwe": {
        "id": "CWE-1025",
        "name": "Comparison Using Wrong Factors"
      },
      "discovery_date": "2026-10-14T17:22:45.689367+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2552574"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in rabbitmq-server, where the Advanced Message Queuing Protocol (AMQP) parser fails to validate the length of message body descriptors. An authenticated remote attacker with write permissions can exploit this vulnerability by publishing a crafted message with an unrecognized descriptor sharing a valid prefix. RabbitMQ misclassifies and stores the payload, causing downstream message consumer applications or cross-protocol conversion processes to crash during message decoding, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rabbitmq-server: rabbitmq-server: Denial of Service via improper AMQP message descriptor validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@aarch64",
          "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@s390x",
          "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@src",
          "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67416"
        },
        {
          "category": "external",
          "summary": "RHBZ#2552574",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552574"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67416",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67416"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67416",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67416"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/commit/c9b4b10c2dbf0f1c89f10b482ac8b45f84dc5954",
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/c9b4b10c2dbf0f1c89f10b482ac8b45f84dc5954"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/commit/d5186e66e056960f58e2d0fbee2fcc66e1ed6fb9",
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/d5186e66e056960f58e2d0fbee2fcc66e1ed6fb9"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/pull/17017",
          "url": "https://github.com/rabbitmq/rabbitmq-server/pull/17017"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/pull/17287",
          "url": "https://github.com/rabbitmq/rabbitmq-server/pull/17287"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.4",
          "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.4"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-p35w-6mx2-q4pc",
          "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-p35w-6mx2-q4pc"
        }
      ],
      "release_date": "2026-10-14T16:00:32.620000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-14T03:09:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@aarch64",
            "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@s390x",
            "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@src",
            "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:82703"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@aarch64",
            "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@s390x",
            "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@src",
            "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rabbitmq-server: rabbitmq-server: Denial of Service via improper AMQP message descriptor validation"
    },
    {
      "cve": "CVE-2026-67418",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-10-14T17:30:33.177126+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2552635"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in rabbitmq-server. An authenticated user with message publishing permissions can transmit a specially crafted Message Queuing Telemetry Transport (MQTT) message containing an invalid property. When the broker forwards this message, an unhandled exception terminates the recipient\u0027s connection, leading to a targeted Denial of Service (DoS) for affected subscribers.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rabbitmq-server: rabbitmq-server: Denial of Service via invalid MQTT PUBLISH property",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@aarch64",
          "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@s390x",
          "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@src",
          "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67418"
        },
        {
          "category": "external",
          "summary": "RHBZ#2552635",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552635"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67418",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67418"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67418",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67418"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/commit/4639a4318c72a0660e4bc014767fad70ce288fbc",
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/4639a4318c72a0660e4bc014767fad70ce288fbc"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/commit/908f944a1d581d10774f8d6d0dcf2a1a713779fb",
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/908f944a1d581d10774f8d6d0dcf2a1a713779fb"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/pull/17035",
          "url": "https://github.com/rabbitmq/rabbitmq-server/pull/17035"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/pull/17287",
          "url": "https://github.com/rabbitmq/rabbitmq-server/pull/17287"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.5",
          "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.5"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-jv99-v328-mvmm",
          "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-jv99-v328-mvmm"
        }
      ],
      "release_date": "2026-10-14T16:07:29.752000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-14T03:09:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@aarch64",
            "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@s390x",
            "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@src",
            "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:82703"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@aarch64",
            "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@s390x",
            "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@src",
            "Red Hat Hardened Images:rabbitmq-server4.3-0:4.3.6-1.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rabbitmq-server: rabbitmq-server: Denial of Service via invalid MQTT PUBLISH property"
    }
  ]
}

CVE-2026-67414 (GCVE-0-2026-67414)

Vulnerability from cvelistv5 – Published: 2026-10-14 16:04 – Updated: 2026-10-14 16:04

Title

RabbitMQ AMQP 1.0 parser: amplification memory-exhaustion DoS via zero-width array aggregation

Summary

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, deps/amqp10_common/src/amqp10_binary_parser.erl materializes each element of AMQP 1.0 arrays whose shared constructor has zero width, while limiting only the number of elements in each array and not the aggregate arrays in a frame. After completing SASL authentication, a low-privilege client can send an ordinary frame containing many individually permitted arrays, causing a small frame to expand into a very large reader-process heap before later frame validation or authorization. Because deps/rabbit/src/rabbit_amqp_reader.erl clears the pre-authentication max_heap_size guard after login, repeated or concurrent frames can trigger the node-wide memory alarm, block publishers, or exhaust broker memory. This issue is fixed in versions 4.0.24, 4.1.15, 4.2.10, and 4.3.4.

Severity

6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7771 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/rabbitmq/rabbitmq-server/secur…	x_refsource_CONFIRM
https://github.com/rabbitmq/rabbitmq-server/commi…	x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-server/relea…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
rabbitmq	rabbitmq-server	Affected: >= 4.0.0, < 4.0.24 Affected: >= 4.1.0, < 4.1.15 Affected: >= 4.2.0, < 4.2.10 Affected: >= 4.3.0, < 4.3.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "rabbitmq-server",
          "vendor": "rabbitmq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.24"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.1.0, \u003c 4.1.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.2.0, \u003c 4.2.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.3.0, \u003c 4.3.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, deps/amqp10_common/src/amqp10_binary_parser.erl materializes each element of AMQP 1.0 arrays whose shared constructor has zero width, while limiting only the number of elements in each array and not the aggregate arrays in a frame. After completing SASL authentication, a low-privilege client can send an ordinary frame containing many individually permitted arrays, causing a small frame to expand into a very large reader-process heap before later frame validation or authorization. Because deps/rabbit/src/rabbit_amqp_reader.erl clears the pre-authentication max_heap_size guard after login, repeated or concurrent frames can trigger the node-wide memory alarm, block publishers, or exhaust broker memory. This issue is fixed in versions 4.0.24, 4.1.15, 4.2.10, and 4.3.4."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T16:04:07.449Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w6mq-4qpx-v7mh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w6mq-4qpx-v7mh"
        },
        {
          "name": "https://github.com/rabbitmq/rabbitmq-server/commit/3f0f67dfb7c4390e3cbfa25ab3ee19dcb0845bd4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/3f0f67dfb7c4390e3cbfa25ab3ee19dcb0845bd4"
        },
        {
          "name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.4"
        }
      ],
      "source": {
        "advisory": "GHSA-w6mq-4qpx-v7mh",
        "discovery": "UNKNOWN"
      },
      "title": "RabbitMQ AMQP 1.0 parser: amplification memory-exhaustion DoS via zero-width array aggregation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-67414",
    "datePublished": "2026-10-14T16:04:07.449Z",
    "dateReserved": "2026-07-29T15:02:20.412Z",
    "dateUpdated": "2026-10-14T16:04:07.449Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-67416 (GCVE-0-2026-67416)

Vulnerability from cvelistv5 – Published: 2026-10-14 16:00 – Updated: 2026-10-15 19:00

Title

RabbitMQ: AMQP 1.0 symbolic body descriptor prefix collisions bypass validation

Summary

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, the optimized AMQP 1.0 server_mode parser in deps/amqp10_common/src/amqp10_binary_parser.erl matches the textual prefixes of symbolic data, sequence, and value body descriptors without verifying their encoded symbol lengths. An authenticated AMQP 1.0 publisher with write permission can submit a well-formed unknown descriptor that begins with a registered body descriptor, and RabbitMQ misclassifies and stores the bytes as a standard body section. Strict AMQP 1.0 consumers can terminate while decoding the stored entry. For bodies misclassified as data, AMQP 0-9-1 or other cross-protocol conversion performs full body decoding and can terminate the consumer protocol process, with acknowledgement-required delivery permitting repeated failures. Sequence and value classifications are normally transported as opaque encoded payloads on that conversion path. The broker remains alive, and the issue does not bypass routing or authorization. This issue is fixed in versions 4.0.24, 4.1.15, 4.2.10, and 4.3.4.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 18:59 UTC

CWE

CWE-20 - Improper Input Validation
CWE-248 - Uncaught Exception
CWE-754 - Improper Check for Unusual or Exceptional Conditions

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7771 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/rabbitmq/rabbitmq-server/secur…	x_refsource_CONFIRM
https://github.com/rabbitmq/rabbitmq-server/pull/17017	x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-server/pull/17287	x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-server/commi…	x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-server/commi…	x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-server/relea…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
rabbitmq	rabbitmq-server	Affected: >= 4.0.0, < 4.0.24 Affected: >= 4.1.0, < 4.1.15 Affected: >= 4.2.0, < 4.2.10 Affected: >= 4.3.0, < 4.3.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-67416",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T18:59:28.390039Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T19:00:24.105Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-p35w-6mx2-q4pc"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "rabbitmq-server",
          "vendor": "rabbitmq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.24"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.1.0, \u003c 4.1.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.2.0, \u003c 4.2.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.3.0, \u003c 4.3.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, the optimized AMQP 1.0 server_mode parser in deps/amqp10_common/src/amqp10_binary_parser.erl matches the textual prefixes of symbolic data, sequence, and value body descriptors without verifying their encoded symbol lengths. An authenticated AMQP 1.0 publisher with write permission can submit a well-formed unknown descriptor that begins with a registered body descriptor, and RabbitMQ misclassifies and stores the bytes as a standard body section. Strict AMQP 1.0 consumers can terminate while decoding the stored entry. For bodies misclassified as data, AMQP 0-9-1 or other cross-protocol conversion performs full body decoding and can terminate the consumer protocol process, with acknowledgement-required delivery permitting repeated failures. Sequence and value classifications are normally transported as opaque encoded payloads on that conversion path. The broker remains alive, and the issue does not bypass routing or authorization. This issue is fixed in versions 4.0.24, 4.1.15, 4.2.10, and 4.3.4."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-754",
              "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T16:00:32.620Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-p35w-6mx2-q4pc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-p35w-6mx2-q4pc"
        },
        {
          "name": "https://github.com/rabbitmq/rabbitmq-server/pull/17017",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-server/pull/17017"
        },
        {
          "name": "https://github.com/rabbitmq/rabbitmq-server/pull/17287",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-server/pull/17287"
        },
        {
          "name": "https://github.com/rabbitmq/rabbitmq-server/commit/c9b4b10c2dbf0f1c89f10b482ac8b45f84dc5954",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/c9b4b10c2dbf0f1c89f10b482ac8b45f84dc5954"
        },
        {
          "name": "https://github.com/rabbitmq/rabbitmq-server/commit/d5186e66e056960f58e2d0fbee2fcc66e1ed6fb9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/d5186e66e056960f58e2d0fbee2fcc66e1ed6fb9"
        },
        {
          "name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.4"
        }
      ],
      "source": {
        "advisory": "GHSA-p35w-6mx2-q4pc",
        "discovery": "UNKNOWN"
      },
      "title": "RabbitMQ: AMQP 1.0 symbolic body descriptor prefix collisions bypass validation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-67416",
    "datePublished": "2026-10-14T16:00:32.620Z",
    "dateReserved": "2026-07-29T15:02:20.412Z",
    "dateUpdated": "2026-10-15T19:00:24.105Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-67418 (GCVE-0-2026-67418)

Vulnerability from cvelistv5 – Published: 2026-10-14 16:07 – Updated: 2026-10-14 17:53

Title

RabbitMQ MQTT 5: inapplicable PUBLISH property disconnects matching subscribers

Summary

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, the MQTT 5 parser in deps/rabbitmq_mqtt/src/rabbit_mqtt_packet.erl accepts Request-Problem-Information on PUBLISH packets even though the property is valid only for CONNECT. An authenticated publisher with topic write permission can cause the broker to store and route that inapplicable property to a separately authenticated matching subscriber. When the subscriber path serializes the outbound PUBLISH, serialise_prop/2 has no matching clause, and the uncontained function_clause exception closes the victim MQTT or Web MQTT connection. The publisher connection and broker remain available, and queued replay, retained-message persistence, and broker-wide denial of service were not established. This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 17:52 UTC

CWE

CWE-1286 - Improper Validation of Syntactic Correctness of Input
CWE-248 - Uncaught Exception

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7771 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/rabbitmq/rabbitmq-server/secur…	x_refsource_CONFIRM
https://github.com/rabbitmq/rabbitmq-server/pull/17035	x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-server/pull/17287	x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-server/commi…	x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-server/commi…	x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-server/relea…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
rabbitmq	rabbitmq-server	Affected: >= 3.13.0, < 3.13.19 Affected: >= 4.0.0, < 4.0.24 Affected: >= 4.1.0, < 4.1.15 Affected: >= 4.2.0, < 4.2.10 Affected: >= 4.3.0, < 4.3.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-67418",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T17:52:54.774490Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T17:53:16.254Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "rabbitmq-server",
          "vendor": "rabbitmq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.13.0, \u003c 3.13.19"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.24"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.1.0, \u003c 4.1.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.2.0, \u003c 4.2.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.3.0, \u003c 4.3.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, the MQTT 5 parser in deps/rabbitmq_mqtt/src/rabbit_mqtt_packet.erl accepts Request-Problem-Information on PUBLISH packets even though the property is valid only for CONNECT. An authenticated publisher with topic write permission can cause the broker to store and route that inapplicable property to a separately authenticated matching subscriber. When the subscriber path serializes the outbound PUBLISH, serialise_prop/2 has no matching clause, and the uncontained function_clause exception closes the victim MQTT or Web MQTT connection. The publisher connection and broker remain available, and queued replay, retained-message persistence, and broker-wide denial of service were not established. This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1286",
              "description": "CWE-1286: Improper Validation of Syntactic Correctness of Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T16:07:29.752Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-jv99-v328-mvmm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-jv99-v328-mvmm"
        },
        {
          "name": "https://github.com/rabbitmq/rabbitmq-server/pull/17035",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-server/pull/17035"
        },
        {
          "name": "https://github.com/rabbitmq/rabbitmq-server/pull/17287",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-server/pull/17287"
        },
        {
          "name": "https://github.com/rabbitmq/rabbitmq-server/commit/4639a4318c72a0660e4bc014767fad70ce288fbc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/4639a4318c72a0660e4bc014767fad70ce288fbc"
        },
        {
          "name": "https://github.com/rabbitmq/rabbitmq-server/commit/908f944a1d581d10774f8d6d0dcf2a1a713779fb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/908f944a1d581d10774f8d6d0dcf2a1a713779fb"
        },
        {
          "name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.5"
        }
      ],
      "source": {
        "advisory": "GHSA-jv99-v328-mvmm",
        "discovery": "UNKNOWN"
      },
      "title": "RabbitMQ MQTT 5: inapplicable PUBLISH property disconnects matching subscribers"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-67418",
    "datePublished": "2026-10-14T16:07:29.752Z",
    "dateReserved": "2026-07-29T15:02:20.412Z",
    "dateUpdated": "2026-10-14T17:53:16.254Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:82703

CVE-2026-67414 (GCVE-0-2026-67414)

CVE-2026-67416 (GCVE-0-2026-67416)

CVE-2026-67418 (GCVE-0-2026-67418)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour